CVE-2026-68222: Linux Kernel Information Disclosure Flaw

CVE-2026-68222 Overview

CVE-2026-68222 is a Linux kernel vulnerability in the msi2500 media driver. The flaw resides in msi2500_start_streaming(), which fails to return queued buffers to the videobuf2 (vb2) framework when error paths are taken. When start_streaming() returns an error without first invoking vb2_buffer_done() on buffers already handed to the driver via buf_queue(), the framework triggers WARN_ON(owned_by_drv_count) and the queued buffers leak. The bug also masks original error codes because ret is overwritten between successive calls in the failure chain.

Critical Impact
A local attacker with access to the affected USB media device interface can trigger buffer leaks and kernel warning conditions, resulting in resource exhaustion and potential memory corruption in the media subsystem.

Affected Products

Linux kernel with the msi2500 USB media driver enabled
Distributions shipping the vulnerable drivers/media/usb/msi2500/ module prior to the fix
Stable kernel branches referenced in commits 1d58229, 264b538, 3673cb0, 7201c17, and bab9d5a

Discovery Timeline

2026-08-10 - CVE-2026-68222 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68222

Vulnerability Analysis

The msi2500 driver implements a USB-attached SDR receiver under the Linux media framework. The vb2 framework passes buffers to drivers via buf_queue() before calling start_streaming(). Drivers must return any queued buffers using vb2_buffer_done() before returning an error, or the framework leaks them and emits a warning.

The original msi2500_start_streaming() implementation contained five distinct error paths that violated this contract. When the USB device was already disconnected, the function returned -ENODEV without releasing buffers. When mutex_lock_interruptible() was interrupted, -ERESTARTSYS was returned without cleanup. Failures in msi2500_set_usb_adc() had their return values silently overwritten by the subsequent msi2500_isoc_init() call, losing the original error. A failure in msi2500_isoc_init() invoked cleanup_queued_bufs but then fell through into msi2500_ctrl_msg(), again masking the real error. Finally, a msi2500_ctrl_msg(CMD_START_STREAMING) failure performed no cleanup at all, leaving isochronous URBs submitted with no consumer.

Root Cause

The root cause is improper error handling combined with a memory leak in a kernel driver. The absence of a consolidated goto-based cleanup chain caused queued buffers to remain owned by the driver on failure, while sequential overwriting of ret obscured actual error codes returned to userspace.

Attack Vector

Exploitation requires local access. A user with permission to open the affected video device node can repeatedly initiate streaming under conditions that force start_streaming() failure, such as forcing device disconnect races or interrupting the mutex acquisition. Each failed invocation leaks queued vb2 buffers and orphans isochronous URBs, degrading kernel memory and potentially destabilizing the media subsystem.

The fix consolidates error handling into a small goto chain. Every failure now stops the function, drains the queued-buffer list with VB2_BUF_STATE_QUEUED, and returns the true error code. The ctrl_msg failure path additionally rolls back msi2500_isoc_init() via msi2500_isoc_cleanup() before unlocking. This mirrors the earlier uvcvideo fix in commit 4cf3b6fd54eb.

Detection Methods for CVE-2026-68222

Indicators of Compromise

Kernel log entries containing WARN_ON(owned_by_drv_count) originating from vb2_start_streaming
Repeated msi2500 driver error returns (-ENODEV, -ERESTARTSYS) correlated with rising slab memory usage
Orphaned isochronous URBs associated with the msi2500 module visible via /sys/kernel/debug/usb/devices

Detection Strategies

Monitor dmesg and journal logs for vb2 framework warnings tied to the msi2500 module
Correlate video device (/dev/video*) open/ioctl activity from non-privileged users with kernel warnings
Track kernel slab allocations for videobuf2 caches to identify unusual growth patterns

Monitoring Recommendations

Enable auditd rules for open, ioctl, and VIDIOC_STREAMON syscalls against /dev/video* nodes
Alert on kernel WARN and BUG events from the media subsystem in centralized log collection
Baseline USB device attach/detach churn on hosts exposing SDR or capture hardware

How to Mitigate CVE-2026-68222

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 1d58229, 264b538, 3673cb0, 7201c17, and bab9d5a
Rebuild and deploy kernel packages from your distribution once the fix lands in vendor updates
Unload the msi2500 module on systems that do not require the associated USB SDR hardware

Patch Information

The fix consolidates the five error paths in msi2500_start_streaming() into a goto chain that drains queued buffers with VB2_BUF_STATE_QUEUED and preserves the original error code. The stop_streaming path retains VB2_BUF_STATE_ERROR semantics via a shared cleanup helper that accepts a vb2_buffer_state argument. Reference the following commits: Kernel Git Commit 1d58229, Kernel Git Commit 264b538, Kernel Git Commit 3673cb0, Kernel Git Commit 7201c17, and Kernel Git Commit bab9d5a.

Workarounds

Blacklist the msi2500 module via /etc/modprobe.d/blacklist-msi2500.conf where the hardware is not in use
Restrict access to /dev/video* nodes to trusted users through group membership and udev rules
Physically disconnect Mirics MSi2500-based USB SDR devices on hosts that do not require them

bash

# Configuration example
echo 'blacklist msi2500' | sudo tee /etc/modprobe.d/blacklist-msi2500.conf
sudo rmmod msi2500 2>/dev/null || true
sudo update-initramfs -u